PHP Critical RCE Bugs Leaked Online; Patches Due Oct 21, 2026 Amid Mass Exploit Warnings
Critical unauthenticated RCE bugs in PHP versions 5 and later have been leaked online, with patches scheduled for release on 21 October 2026.
Key points
- PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 carry a CVSS score of 9.2.
- Details were leaked ahead of coordinated disclosure, prompting warnings of imminent mass exploitation.
- Patches are planned for 21 October 2026 but may be released earlier if exploitation evidence emerges.
Details regarding two critical-severity PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, have been leaked online before official patches were available. The issues, collectively referred to as PHP2Shell, could potentially lead to unauthenticated remote code execution, according to SecurityWeek. PHP warned that patches are planned for 21 October 2026 at 14:00 UTC, urging defenders to prepare for immediate upgrades.
Root cause
Public reporting does not provide comprehensive technical details on the root causes or affected components for both flaws. However, one report suggests that CVE-2026-109618 is a use-after-free bug. CERT-EU states that based on their CVSS scores, both vulnerabilities could be exploited without authentication. WatchTowr CEO Benjamin Harris confirmed the vulnerabilities are real after successfully reproducing CVE-2026-109618, but refrained from sharing further technical information.
Attack path
The leaked details do not specify the exact attack path or the specific component affected by these defects. The moniker PHP2Shell suggests that attackers could exploit these flaws to obtain shells on vulnerable servers. WatchTowr and Huntress say they have not seen either vulnerability being exploited in the wild yet. Sansec, however, warns that mass exploitation will likely start within 15 minutes of the patch release.
Affected versions
Public reporting suggests that all PHP versions from PHP 5 onwards are affected by these critical security defects. Defenders should verify their current PHP version against this range. PHP stated that fixes may be rolled out earlier than scheduled if technical details are published or if evidence of in-the-wild exploitation emerges.
Mitigation
- Prepare systems for immediate patching as soon as the release is available.
- Monitor official PHP channels for announcements regarding early patch releases.
- Verify current PHP versions to determine if they fall within the affected range from PHP 5 onwards.
Signals worth monitoring
Teams usually monitor web server access logs for unusual request patterns that precede shell access. Check whether any unexpected outbound connections are originating from web-facing servers, which often indicates command-and-control communication. Look for new processes spawned by the web server user that differ from standard application behaviour. Review file integrity monitoring alerts for changes to configuration files or the addition of new scripts. These indicators help identify potential exploitation attempts before full compromise is achieved.
Background: CVSS score
A CVE is a unique identifier for a specific security flaw, acting like a name tag. A CVSS score is a numerical rating of that flaw’s severity. You use the CVE to find the issue and the CVSS score to decide how urgently you must fix it. They serve different functions in your workflow.
Read the full guide: Difference Between CVE and CVSS Score: How to Priorise Remediation
What to do and how to stay safe: PHP
- Inventory all servers running PHP to identify those using versions 5 or later.
- Configure alerting for any unexpected code execution or shell spawns on web hosts.
- Restrict network access to PHP servers to limit exposure from untrusted networks.
- Prepare automated patching procedures to deploy updates immediately once released.
Step-by-step guide: Out-of-band patches: what small businesses need to know
General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When are the patches for CVE-2026-109618 and CVE-2026-109619 scheduled for release?
Patches are planned for 21 October 2026 at 14:00 UTC, but may be released earlier.
Are these vulnerabilities currently being exploited in the wild?
WatchTowr and Huntress say they have not seen either vulnerability being exploited in the wild.
Which PHP versions are affected by the PHP2Shell vulnerabilities?
Public reporting suggests all PHP versions from PHP 5 onwards are affected.
